diff --git a/dashboard/web/components/Sidebar.tsx b/dashboard/web/components/Sidebar.tsx
index 47c80634a5bff60bc22ea9118674ee0f17bcc933..93a9263c2c63927f2d249b19cbb100d1dc5055dc 100644
--- a/dashboard/web/components/Sidebar.tsx
+++ b/dashboard/web/components/Sidebar.tsx
@@ -157,7 +157,7 @@ function VMNav() {
     <div class="nav-group" classList={{ open: open() }} inert={!open()}><div>
       <For each={loaded()?.domains}>{(vm) => <a href={`/vms?vm=${encodeURIComponent(vm.name)}`} class="nav-sub"
         aria-current={selected() === vm.name ? "page" : undefined}>
-        <Monitor class="icon" /><span class="label">{vm.name}</span><Status health={vm.state === "running" ? "healthy" : vm.state === "crashed" ? "down" : "stopped"} />
+        <Monitor class="icon" /><span class="label">{vm.name}</span><Status health={vm.setup === "failed" || vm.state === "crashed" ? "down" : vm.state === "running" ? vm.setup && vm.setup !== "ready" ? "starting" : "healthy" : "stopped"} />
       </a>}</For>
       <Show when={data.error && !loaded()}><span class="nav-sub muted">VMs unavailable</span></Show>
     </div></div>
diff --git a/dashboard/web/components/VMConsole.tsx b/dashboard/web/components/VMConsole.tsx
index 602099de40a6935c43359cf99f3ebaf389917cbc..1263edcf49ce81a097475716d40eb62406248690 100644
--- a/dashboard/web/components/VMConsole.tsx
+++ b/dashboard/web/components/VMConsole.tsx
@@ -1,5 +1,5 @@
 import { VMMenu } from "./VMMenu.tsx";
-import { createEffect, createMemo, createSignal, type JSX, onCleanup, Show } from "solid-js";
+import { createEffect, createMemo, createSignal, type JSX, on, onCleanup, Show } from "solid-js";
 import { reason } from "../api.ts";
 import Keyboard from "lucide-solid/icons/keyboard";
 import Clipboard from "lucide-solid/icons/clipboard";
@@ -7,6 +7,8 @@ import Maximize from "lucide-solid/icons/maximize";
 import RefreshCw from "lucide-solid/icons/refresh-cw";
 import Check from "lucide-solid/icons/check";
 import RemoteKeyboard from "@novnc/keyboard";
+import { VM_SETUP, type Domain } from "../types/vms.ts";
+import { StatusLabel } from "./Status.tsx";
 
 type WindowSurface = {
   id: number; x: number; y: number; width: number; height: number; atlas_x: number; atlas_y: number;
@@ -14,8 +16,10 @@ type WindowSurface = {
 };
 type WindowFrame = { windows: WindowSurface[]; rtpTimestamp: number };
 
-export function VMConsole(props: { name: string; enabled: boolean; active: boolean; toolbar: JSX.Element; content: (toolbar: HTMLDivElement) => JSX.Element }) {
+export function VMConsole(props: { name: string; enabled: boolean; active: boolean; setup?: Domain["setup"]; toolbar: JSX.Element; content: (toolbar: HTMLDivElement) => JSX.Element }) {
   const enabled = createMemo(() => props.enabled);
+  const preparing = () => !!props.setup && props.setup !== "ready";
+  let reconnectTimer: number | undefined;
   let attempt = 0;
   let video!: HTMLVideoElement;
   let canvas!: HTMLCanvasElement;
@@ -121,6 +125,13 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
       const keyboard = new RemoteKeyboard(video);
       const focus = () => { if (input?.readyState === "open") keyboard.grab(); };
       const blur = () => { keyboard.ungrab(); release(); };
+      const releaseKeyboard = (event: KeyboardEvent) => {
+        if (event.key !== "Escape" || !event.ctrlKey || !event.altKey) return;
+        event.preventDefault();
+        event.stopImmediatePropagation();
+        tools()?.querySelector<HTMLElement>("summary")?.focus();
+      };
+      video.addEventListener("keydown", releaseKeyboard, true);
       video.addEventListener("focus", focus);
       video.addEventListener("blur", blur);
       let peer: RTCPeerConnection | undefined;
@@ -171,13 +182,23 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
       const fail = (message: string) => {
         if (current !== attempt || disposed) return;
         setState("Disconnected");
-        setProblem(message);
         disconnect();
+        if (preparing() && props.setup !== "failed") {
+          setProblem("");
+          reconnectTimer = window.setTimeout(connect, 1000);
+        } else setProblem(message);
       };
       const timeout = window.setTimeout(() => fail("The screen couldn't connect. Reconnect to try again."), 20000);
+      const ready = () => {
+        if (current !== attempt || disposed || video.readyState < 2 || input?.readyState !== "open") return;
+        clearTimeout(timeout);
+        setState("Connected");
+      };
       disconnect = () => {
+        clearTimeout(reconnectTimer);
         clearTimeout(timeout);
         blur();
+        video.removeEventListener("keydown", releaseKeyboard, true);
         video.removeEventListener("focus", focus);
         video.removeEventListener("blur", blur);
         socket.onclose = null;
@@ -219,6 +240,7 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
               movement = peer.createDataChannel("pointer", { ordered: false, maxRetransmits: 0 });
               keyboard.onkeyevent = (key, _code, down) => send({ type: "key", key, down });
               input.onopen = () => {
+                ready();
                 if (document.activeElement === video) focus();
                 if (windowsAvailable()) send({ type: "experiment", enabled: separateWindows() });
               };
@@ -308,10 +330,8 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
       };
       video.onplaying = () => {
         if (current !== attempt || disposed) return;
-        clearTimeout(timeout);
-        setState("Connected");
+        ready();
         compose();
-        if (props.active) video.focus();
       };
     } catch (failure) {
       console.error("VM screen connection", failure);
@@ -330,7 +350,10 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
       setProblem("");
     }
   });
-  createEffect(() => { if (props.active && connected()) video.focus(); else release(); });
+  createEffect(() => { if (props.active && connected() && !preparing()) video.focus(); else release(); });
+  createEffect(on(() => props.setup, setup => {
+    if (setup === "ready" && enabled() && state() === "Disconnected") void connect();
+  }, { defer: true }));
   onCleanup(() => { disposed = true; disconnect(); });
   const pointer = (event: PointerEvent | WheelEvent, mask = buttons) => {
     if (!connected() || !width || !height) return;
@@ -380,7 +403,8 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
         <button disabled={!props.enabled || state() === "Connecting…"} onClick={connect}><RefreshCw size={14} aria-hidden="true" />Reconnect</button>
       </VMMenu>
       <span class="spacer" />
-      <span class="vm-console-status" role="status">{props.enabled ? state() : "Off"}</span>
+      <Show when={connected() && !preparing()}><span class="vm-console-status" id={`keyboard-release-${props.name}`}>Ctrl+Alt+Esc releases keyboard</span></Show>
+      <span class="vm-console-status" role="status">{preparing() ? "" : props.enabled ? state() : "Off"}</span>
       </Show>
     </div>
     <Show when={props.active && showStats()}>
@@ -390,7 +414,7 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
         <Show when={separateWindows()}><span>{windowCapture() ? "Separate windows" : "Desktop fallback"}</span></Show>
       </div>
     </Show>
-    <Show when={props.active && problem()}><p class="error vm-console-error" role="alert">{problem()}</p></Show>
+    <Show when={props.active && !preparing() && problem()}><p class="error vm-console-error" role="alert">{problem()}</p></Show>
     <Show when={props.active && showClipboard()}>
       <div class="vm-clipboard">
         <label class="field">clipboard<textarea class="search" rows="3" value={clipboard()} onInput={(event) => setClipboard(event.currentTarget.value)} /></label>
@@ -401,9 +425,15 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
         </div>
       </div>
     </Show>
-    <div class="vm-console-screen" hidden={!props.active || !props.enabled}>
+    <Show when={props.active && props.enabled && preparing()}>
+      <div class="empty vm-setup" role={props.setup === "failed" ? "alert" : "status"}>
+        <StatusLabel health={props.setup === "failed" ? "down" : "starting"}>{VM_SETUP[props.setup!]}</StatusLabel>
+        <p>{props.setup === "failed" ? "Restart this VM from the Machine menu to retry." : "Your desktop opens here when setup finishes."}</p>
+      </div>
+    </Show>
+    <div class="vm-console-screen" hidden={!props.active || !props.enabled || preparing()}>
       <canvas ref={canvas} class="vm-window-canvas" hidden aria-hidden="true" />
-      <video ref={video} autoplay muted playsinline tabindex="0" aria-label="VM screen"
+      <video ref={video} autoplay muted playsinline tabindex="0" aria-label="VM screen" aria-describedby={`keyboard-release-${props.name}`}
         onContextMenu={(event) => event.preventDefault()}
         onPointerMove={pointer}
         onPointerLeave={() => { cursorInside = false; drawCursor(); }}
diff --git a/dashboard/web/pages/VMs.css b/dashboard/web/pages/VMs.css
index 01ab01043433f1348c96df7024f8b89d5ddcca3c..43b3386cb626bc2af116cab51f1fe77092b79259 100644
--- a/dashboard/web/pages/VMs.css
+++ b/dashboard/web/pages/VMs.css
@@ -1,4 +1,5 @@
 .vms-list th:not(:first-child), .vms-list tr.top > td:not(.title) { width: 1%; white-space: nowrap; }
+.vm-setup { flex: 1; display: grid; align-content: center; justify-items: center; gap: 12px; }
 .vms-list .row-skeleton { height: 36px; margin: 14px var(--gutter); }
 
 .vms-list tbody.vm tr { cursor: pointer; }
diff --git a/dashboard/web/pages/VMs.tsx b/dashboard/web/pages/VMs.tsx
index fe344b60aab162e35f5c0b49f0b09a9e54907952..23f5994d0dfe634349fe38d72f7dffb09704cf0f 100644
--- a/dashboard/web/pages/VMs.tsx
+++ b/dashboard/web/pages/VMs.tsx
@@ -19,6 +19,7 @@ import Usb from "lucide-solid/icons/usb";
 import { createEffect, createMemo, createResource, createSignal, For, lazy, onCleanup, Show } from "solid-js";
 import { LIVE_INTERVAL } from "../types/model.ts";
 import type { Domain, DOMAIN_ACTIONS, Hostdev, VMLibrary } from "../types/vms.ts";
+import { VM_SETUP } from "../types/vms.ts";
 import { DetailedError, parseResponse } from "hono/client";
 import { api, queries, reason, unconnected } from "../api.ts";
 import { VMConsole } from "../components/VMConsole.tsx";
@@ -53,6 +54,7 @@ const running = (vm: Domain) => vm.state === "running" || vm.state === "blocked"
 
 function status(vm: Domain): [StatusKind, string, tip?: string] {
   if (running(vm)) {
+    if (vm.setup && vm.setup !== "ready") return [vm.setup === "failed" ? "down" : vm.setup === "restarting" ? "restarting" : "starting", VM_SETUP[vm.setup]];
     if (vm.startedAt === null) return ["healthy", "up"];
     const up = Date.now() / 1000 - vm.startedAt!;
     const started = `started ${datetime(vm.startedAt!)}`;
@@ -219,7 +221,8 @@ function create(node: { cpus: number; memory: number; availableMemory: number },
       const generatedName = () => `testbox-${(choice() || "custom").slice(0, 46)}-${suffix}`;
       const [name, setName] = createSignal(generatedName());
       const recommended = () => selected()?.recommended ?? { vcpus: 2, memory: 4 * GiB, disk: 32 * GiB };
-      const [vcpus, setVcpus] = createSignal(Math.min(node.cpus, recommended().vcpus));
+      const maximumCpus = () => selected()?.platform === "macos" ? 1 : node.cpus;
+      const [vcpus, setVcpus] = createSignal(Math.min(maximumCpus(), recommended().vcpus));
       const [memory, setMemory] = createSignal(Math.min(node.memory, recommended().memory) / GiB);
       const [disk, setDisk] = createSignal(Math.ceil(recommended().disk / GiB));
       const minimumDisk = () => Math.max(1, Math.ceil((selected()?.capacity ?? 0) / GiB));
@@ -232,7 +235,7 @@ function create(node: { cpus: number; memory: number; availableMemory: number },
           const previousName = generatedName();
           setChoice(event.currentTarget.value);
           if (name() === previousName) setName(generatedName());
-          setVcpus(Math.min(node.cpus, recommended().vcpus));
+          setVcpus(Math.min(maximumCpus(), recommended().vcpus));
           setMemory(Math.min(node.memory, recommended().memory) / GiB);
           setDisk(Math.ceil(recommended().disk / GiB));
         }}>
@@ -255,8 +258,8 @@ function create(node: { cpus: number; memory: number; availableMemory: number },
         </label>
         <div class="vm-resources">
           <label class="vm-resource"><span>CPUs<output>{vcpus()}</output></span>
-            <input name="vcpus" aria-label="CPUs" type="range" min="1" max={node.cpus} value={vcpus()} onInput={(event) => setVcpus(Number(event.currentTarget.value))} />
-            <span class="vm-resource-scale"><span>1</span><span>{node.cpus}</span></span>
+            <input name="vcpus" aria-label="CPUs" type="range" min="1" max={maximumCpus()} value={vcpus()} onInput={(event) => setVcpus(Number(event.currentTarget.value))} />
+            <span class="vm-resource-scale"><span>1</span><span>{maximumCpus()}</span></span>
           </label>
           <label class="vm-resource"><span>Memory<output>{bytes(memory() * GiB)}</output></span>
             <input name="memory" aria-label="Memory" type="range" min="0.5" max={Math.floor(node.memory / GiB)} step="0.5" value={memory()} onInput={(event) => setMemory(Number(event.currentTarget.value))} />
@@ -283,7 +286,7 @@ function create(node: { cpus: number; memory: number; availableMemory: number },
       const name = String(form.get("name"));
       await parseResponse(api.vms.$post({ json: {
         name, image: String(form.get("image")), mode: form.get("mode") === "preset" ? "preset" : "iso",
-        firmware: form.get("firmware") === "uefi" ? "uefi" : "bios", platform: form.get("platform") === "windows" ? "windows" : "linux",
+        firmware: form.get("firmware") === "uefi" ? "uefi" : "bios", platform: form.get("platform") === "windows" ? "windows" : form.get("platform") === "macos" ? "macos" : "linux",
         vcpus: Number(form.get("vcpus")), memory: Math.round(Number(form.get("memory")) * GiB), disk: Math.round(Number(form.get("disk")) * GiB),
       } }));
       await refetch();
@@ -625,7 +628,7 @@ export function VMs() {
       <div class="empty vms-empty"><p>This VM isn't in your account.</p><button class="button" onClick={() => setParams({ vm: undefined, tab: undefined })}>VM home</button></div>
     }>{(vm) => <section class="vm-workspace" aria-label={`${name} workspace`}>
       <h1 class="sr-only">{name}</h1>
-      <VMConsole name={name} enabled={!isOff(vm())} active={activeTab() === "screen"}
+      <VMConsole name={name} enabled={!isOff(vm())} active={activeTab() === "screen"} setup={vm().setup}
         content={(toolbar) => <>
           <Show when={consoleOpened()}><VMSerial name={name} enabled={running(vm()) && vm().platform === "linux" && vm().serial} active={activeTab() === "console"} toolbar={toolbar} /></Show>
           <Show when={activeTab() === "hardware"}><Hardware vm={vm()} refetch={refetch} username={access()?.username} hostname={access()?.hostname} /></Show>
@@ -640,7 +643,7 @@ export function VMs() {
             <PowerControls vm={vm()} refetch={refetch} />
             <button disabled={!running(vm())} onClick={() => restart(vm(), refetch)}><RotateCw size={14} aria-hidden="true" />Restart</button>
             <Show when={vm().state !== "shutdown"}><button disabled={isOff(vm())} onClick={() => forceOff(vm(), refetch)}><Square size={14} aria-hidden="true" />Force off</button></Show>
-            <Show when={latest().canPublish}><button disabled={vm().state !== "shutoff"} title={vm().state !== "shutoff" ? "Shut down before saving a preset" : undefined} onClick={() => savePreset(vm(), refetch)}><Save size={14} aria-hidden="true" />Save preset</button></Show>
+            <Show when={latest().canPublish && vm().platform !== "macos"}><button disabled={vm().state !== "shutoff"} title={vm().state !== "shutoff" ? "Shut down before saving a preset" : undefined} onClick={() => savePreset(vm(), refetch)}><Save size={14} aria-hidden="true" />Save preset</button></Show>
             <button class="danger" onClick={() => remove(vm(), refetch)}><Trash size={14} aria-hidden="true" />Delete</button>
           </VMMenu>
           <VMMenu label="Media">
diff --git a/dashboard/web/types/vms.ts b/dashboard/web/types/vms.ts
index 7e6b812ae66efd6d3b8629e4df09c9b00e5fbc61..113c03abc0c444bf0642a771dc1d3b363d830e78 100644
--- a/dashboard/web/types/vms.ts
+++ b/dashboard/web/types/vms.ts
@@ -21,6 +21,16 @@ export interface Hostdev {
   iommuGroup: number | null;
 }
 
+type Platform = "linux" | "windows" | "macos";
+
+export const VM_SETUP = {
+  starting: "Starting Windows…",
+  personalizing: "Preparing your account…",
+  restarting: "Restarting to finish setup…",
+  ready: "Ready",
+  failed: "Setup stopped",
+} as const;
+
 export interface Domain {
   name: string;
   owner: string | null;
@@ -44,10 +54,11 @@ export interface Domain {
   usage: { cpu: number; memory: number } | null;
   /** The guest agent channel's state; null when the domain has none. */
   agent: "connected" | "disconnected" | null;
+  setup: keyof typeof VM_SETUP | null;
   disks: Disk[];
   media: { target: string; source: string | null }[];
   firmware: "bios" | "uefi";
-  platform: "linux" | "windows";
+  platform: Platform;
   console: boolean;
   serial: boolean;
   /** `source` is the bridge or libvirt network; addresses come from DHCP leases. */
@@ -75,7 +86,7 @@ export interface Preset {
   os: string;
   description: string;
   firmware: "bios" | "uefi";
-  platform: "linux" | "windows";
+  platform: Platform;
   capacity: number;
   createdAt: number;
   recommended: { vcpus: number; memory: number; disk: number };
@@ -85,4 +96,4 @@ export interface VMLibrary {
   installers: Installer[];
   presets: Preset[];
 }
-export type NewDomain = {mode:"iso"|"preset";firmware:"bios"|"uefi";platform:"linux"|"windows";name:string;image:string;vcpus:number;memory:number;disk:number};
+export type NewDomain = {mode:"iso"|"preset";firmware:"bios"|"uefi";platform:Platform;name:string;image:string;vcpus:number;memory:number;disk:number};
diff --git a/guest/install.ps1 b/guest/install.ps1
index de3defa0758f32fe3042faf9332c864cc1170255..894b84b81b9c8dd05a024de9d9cf8f6f753f9511 100644
--- a/guest/install.ps1
+++ b/guest/install.ps1
@@ -1,15 +1,22 @@
-param([string]$Binary, [switch]$Remove)
+param([string]$Binary, [switch]$Remove, [string]$User)
 $ErrorActionPreference = 'Stop'
 $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
 $principal = New-Object Security.Principal.WindowsPrincipal($identity)
 if (!$principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { throw 'Run this installer as administrator to access the VirtIO serial port.' }
-if ((Get-WmiObject Win32_ComputerSystem).UserName -ne $identity.Name) { throw 'Run this installer from the signed-in administrator account on the VM desktop.' }
+if ($User) {
+    if (!$identity.IsSystem) { throw 'Only system provisioning can select another account.' }
+    $account = New-Object Security.Principal.NTAccount($env:COMPUTERNAME, $User)
+    $sid = $account.Translate([Security.Principal.SecurityIdentifier]).Value
+} else {
+    if ((Get-WmiObject Win32_ComputerSystem).UserName -ne $identity.Name) { throw 'Run this installer from the signed-in administrator account on the VM desktop.' }
+    $sid = $identity.User.Value
+}
 $directory = Join-Path $env:ProgramFiles 'Snowglobe\Guest'
 $destination = Join-Path $directory 'snowglobe-guest.exe'
 $service = New-Object -ComObject Schedule.Service
 $service.Connect()
 $folder = $service.GetFolder('\')
-$name = 'SnowglobeGuest-' + $identity.User.Value
+$name = 'SnowglobeGuest-' + $sid
 if ($Remove) {
     try { $folder.GetTask($name).Stop(0); $folder.DeleteTask($name, 0) } catch { if (Test-Path $destination) { throw } }
     $used = $false
@@ -20,19 +27,25 @@ if ($Remove) {
     return
 }
 if (!$Binary) { throw 'Pass the path to the guest executable with -Binary.' }
-Get-WmiObject Win32_Process -Filter "name='snowglobe-guest.exe'" | Where-Object { $_.ExecutablePath -eq $destination } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
+Get-WmiObject Win32_Process -Filter "name='snowglobe-guest.exe'" | Where-Object { $_.ExecutablePath -eq $destination } | ForEach-Object {
+    $process = Get-Process -Id $_.ProcessId -ErrorAction SilentlyContinue
+    if ($process) {
+        $process | Stop-Process -Force
+        if (!$process.WaitForExit(10000)) { throw 'The guest agent did not stop. Restart the VM and retry.' }
+    }
+}
 New-Item -ItemType Directory -Path $directory -Force | Out-Null
 Copy-Item -LiteralPath $Binary -Destination $destination -Force
 $task = $service.NewTask(0)
-$task.Principal.UserId = $identity.User.Value
+$task.Principal.UserId = $sid
 $task.Principal.LogonType = 3
 $task.Principal.RunLevel = 1
 $task.Settings.ExecutionTimeLimit = 'PT0S'
 $task.Settings.DisallowStartIfOnBatteries = $false
 $task.Settings.StopIfGoingOnBatteries = $false
 $trigger = $task.Triggers.Create(9)
-$trigger.UserId = $identity.User.Value
+$trigger.UserId = $sid
 $action = $task.Actions.Create(0)
 $action.Path = $destination
-$registered = $folder.RegisterTaskDefinition($name, $task, 6, $identity.User.Value, $null, 3, $null)
+$registered = $folder.RegisterTaskDefinition($name, $task, 6, $sid, $null, 3, $null)
 $registered.Run($null) | Out-Null
diff --git a/guest/osx-provision.py b/guest/osx-provision.py
new file mode 100644
index 0000000000000000000000000000000000000000..42074857efe3b00a5922ed3f0f74cbeeeba75bb6
--- /dev/null
+++ b/guest/osx-provision.py
@@ -0,0 +1,227 @@
+#!/usr/bin/python
+import glob
+import json
+import os
+import plistlib
+import pwd
+import re
+import shutil
+import struct
+import subprocess
+import sys
+import time
+
+
+SCRIPT = "/Library/Scripts/snowglobe-provision.py"
+STATE = "/var/db/snowglobe"
+
+
+def write(path, data, mode=0o600):
+    with open(path, "wb") as outgoing:
+        outgoing.write(data)
+    os.chmod(path, mode)
+
+
+def autologin(username, password):
+    # loginwindow requires a NUL terminator and 12-byte blocks.
+    key = [125, 137, 82, 35, 210, 188, 221, 234, 163, 185, 31]
+    data = bytearray(password.encode("ascii"))
+    data.extend([0] * (12 - len(data) % 12))
+    encoded = [value ^ key[index % len(key)] for index, value in enumerate(data)]
+    write("/etc/kcpassword", struct.pack("%dB" % len(encoded), *encoded))
+    subprocess.check_call(["/usr/bin/defaults", "write", "/Library/Preferences/com.apple.loginwindow", "autoLoginUser", username])
+    os.chmod("/Library/Preferences/com.apple.loginwindow.plist", 0o644)
+
+
+def main():
+    os.umask(0o077)
+    if sys.argv[1:] == ["welcome"]:
+        notice = os.path.expanduser("~/VM Login.txt")
+        if os.path.isfile(notice):
+            subprocess.check_call(["/usr/bin/open", "-a", "TextEdit", notice])
+        return
+    if sys.argv[1:] == ["keychain"]:
+        password = sys.stdin.read()
+        keychain = os.path.expanduser("~/Library/Keychains/login.keychain")
+        security = ["/usr/bin/security"]
+        with open("/dev/null", "wb") as quiet:
+            if os.path.isfile(keychain):
+                subprocess.check_call(security + ["lock-keychain", keychain], stdout=quiet, stderr=quiet)
+                if subprocess.call(security + ["unlock-keychain", "-p", password, keychain], stdout=quiet, stderr=quiet):
+                    if subprocess.call(security + ["set-keychain-password", "-o", "password", "-p", password, keychain], stdout=quiet, stderr=quiet):
+                        raise ValueError("The guest login keychain password could not be updated.")
+            elif subprocess.call(security + ["create-keychain", "-p", password, keychain], stdout=quiet, stderr=quiet):
+                raise ValueError("The guest login keychain could not be created.")
+            if subprocess.call(security + ["unlock-keychain", "-p", password, keychain], stdout=quiet, stderr=quiet):
+                raise ValueError("The guest login keychain could not be unlocked.")
+        subprocess.check_call(security + ["default-keychain", "-s", keychain])
+        return
+    if os.geteuid() != 0:
+        raise ValueError("Run guest provisioning as root.")
+    version = subprocess.Popen([
+        "/usr/bin/sw_vers", "-productVersion",
+    ], stdout=subprocess.PIPE).communicate()[0].strip().split(".")[:2]
+    if sys.argv[1:] == ["install"]:
+        shutil.copyfile(__file__, SCRIPT)
+        os.chmod(SCRIPT, 0o755)
+        if not os.path.isdir(STATE):
+            os.mkdir(STATE, 0o700)
+        plistlib.writePlist({
+            "Label": "net.paperclover.snowglobe.provision",
+            "ProgramArguments": ["/usr/bin/python", SCRIPT],
+            "RunAtLoad": True,
+            "KeepAlive": {"SuccessfulExit": False},
+            "ThrottleInterval": 10,
+            "StandardErrorPath": STATE + "/provision.log",
+        }, "/Library/LaunchDaemons/net.paperclover.snowglobe.provision.plist")
+        os.chmod("/Library/LaunchDaemons/net.paperclover.snowglobe.provision.plist", 0o644)
+        if version == ["10", "6"]:
+            path = "/System/Library/Extensions/IOHIDFamily.kext/Contents/PlugIns/IOHIDEventDriverSafeBoot.kext/Contents/Info.plist"
+            driver = plistlib.readPlist(path)
+            personalities = driver["IOKitPersonalities"]
+            tablet = dict(next(value for value in personalities.values() if value["IOClass"] == "IOHIDEventDriver" and "VendorID" not in value))
+            # QEMU tablet coordinates cover the full display without Snow Leopard's 15% border.
+            tablet.update(VendorID=1575, ProductID=1, IOProbeScore=1000, AbsoluteAxisBoundsRemovalPercentage=0)
+            personalities["QEMU USB Tablet"] = tablet
+            plistlib.writePlist(driver, path)
+            subprocess.check_call(["/usr/bin/touch", "/System/Library/Extensions"])
+            subprocess.check_call(["/usr/sbin/kextcache", "-u", "/"])
+        autologin("sandbox", "password")
+        return
+    if sys.argv[1:]:
+        raise ValueError("Use install or welcome, or omit the argument to provision.")
+    if os.path.isfile(STATE + "/prepared"):
+        return
+    seed = "/Volumes/SNOWGLOBE"
+    while not os.path.isfile(seed + "/access.json"):
+        if not os.path.isdir(seed):
+            os.mkdir(seed, 0o700)
+        # Snow Leopard's diskutil plist discovery crashes on the emulated optical drive.
+        with open("/dev/null", "wb") as quiet:
+            for device in glob.glob("/dev/disk[0-9]*"):
+                if subprocess.call(["/sbin/mount", "-t", "cd9660", "-o", "rdonly", device, seed], stdout=quiet, stderr=quiet):
+                    continue
+                if os.path.isfile(seed + "/access.json"):
+                    break
+                subprocess.check_call(["/sbin/umount", seed])
+        time.sleep(2)
+    with open(seed + "/access.json") as incoming:
+        access = json.load(incoming)
+    username = access["username"]
+    password = access["password"]
+    hostname = access["hostname"]
+    if (not re.match(r"^[a-z_][a-z0-9_-]{0,31}\Z", username) or username == "root"
+            or not re.match(r"^[A-Za-z0-9_-]{16,64}\Z", password)
+            or not re.match(r"^snowglobe-vm-[a-f0-9]{8}\Z", hostname)):
+        raise ValueError("The guest provisioning account is malformed.")
+    for field in ["ComputerName", "LocalHostName", "HostName"]:
+        subprocess.check_call(["/usr/sbin/scutil", "--set", field, hostname])
+    subprocess.check_call(["/usr/bin/pmset", "-a", "sleep", "0", "displaysleep", "0", "disksleep", "0"])
+    # The login keychain needs the base account's GUI session.
+    while not re.search(r"(?m)^\s*501\s+.*/Dock\s*$", subprocess.Popen([
+        "/bin/ps", "-axo", "uid,comm",
+    ], stdout=subprocess.PIPE).communicate()[0]):
+        time.sleep(2)
+    account = pwd.getpwuid(501)
+    if account.pw_name not in ("sandbox", username):
+        raise ValueError("This preset needs a sandbox account with UID 501.")
+    home = "/Users/" + username
+    if account.pw_name != username:
+        if os.path.exists(home):
+            raise ValueError("The guest account's home already exists.")
+        subprocess.check_call(["/usr/bin/dscl", ".", "-change", "/Users/sandbox", "RecordName", "sandbox", username])
+    if account.pw_dir != home and os.path.isdir(account.pw_dir):
+        os.rename(account.pw_dir, home)
+    record = "/Users/" + username
+    for field, value in [("NFSHomeDirectory", home), ("RealName", username)]:
+        subprocess.check_call(["/usr/bin/dscl", ".", "-create", record, field, value])
+    if subprocess.call(["/usr/bin/dscl", ".", "-passwd", record, password]):
+        raise ValueError("The guest account password could not be set.")
+    if username != "sandbox":
+        groups = plistlib.readPlistFromString(subprocess.Popen([
+            "/usr/bin/dscl", "-plist", ".", "-readall", "/Groups", "RecordName", "GroupMembership",
+        ], stdout=subprocess.PIPE).communicate()[0])
+        for group in groups:
+            if "sandbox" in group.get("dsAttrTypeStandard:GroupMembership", []):
+                subprocess.check_call([
+                    "/usr/bin/dscl", ".", "-change", "/Groups/" + group["dsAttrTypeStandard:RecordName"][0],
+                    "GroupMembership", "sandbox", username,
+                ])
+    subprocess.check_call(["/usr/sbin/dseditgroup", "-o", "edit", "-a", username, "-t", "user", "admin"])
+    subprocess.check_call(["/usr/bin/dscacheutil", "-flushcache"])
+    keychains = home + "/Library/Keychains"
+    if not os.path.isdir(keychains):
+        os.makedirs(keychains)
+        os.chmod(keychains, 0o700)
+        os.chown(keychains, 501, account.pw_gid)
+    # Keep keychain passwords out of sudo's command log.
+    keychain = subprocess.Popen([
+        "/usr/bin/sudo", "-H", "-u", username, "/usr/bin/python", SCRIPT, "keychain",
+    ], stdin=subprocess.PIPE)
+    keychain.communicate(password.encode("ascii"))
+    if keychain.returncode:
+        raise ValueError("The guest login keychain could not be prepared.")
+    ssh = home + "/.ssh"
+    if not os.path.isdir(ssh):
+        os.mkdir(ssh, 0o700)
+    shutil.copyfile(seed + "/authorized_keys", ssh + "/authorized_keys")
+    os.chmod(ssh + "/authorized_keys", 0o600)
+    os.chown(ssh, 501, account.pw_gid)
+    os.chown(ssh + "/authorized_keys", 501, account.pw_gid)
+    ssh_dir = "/etc/ssh" if os.path.isdir("/etc/ssh") else "/etc"
+    for suffix in ["", ".pub"]:
+        path = ssh_dir + "/ssh_host_rsa_key" + suffix
+        shutil.copyfile(seed + "/ssh_host_rsa_key" + suffix, path)
+        os.chmod(path, 0o644 if suffix else 0o600)
+    config = ("Protocol 2\nHostKey " + ssh_dir + "/ssh_host_rsa_key\n"
+              "PubkeyAuthentication yes\nPasswordAuthentication no\n"
+              "ChallengeResponseAuthentication no\nPermitRootLogin no\n"
+              "AllowUsers " + username + "\nAllowTcpForwarding no\n"
+              "X11Forwarding no\nPermitTunnel no\nUseDNS no\nUsePAM yes\n")
+    write(ssh_dir + "/sshd_config", config.encode("ascii"))
+    subprocess.check_call(["/usr/sbin/sshd", "-t"])
+    subprocess.check_call(["/usr/sbin/systemsetup", "-setremotelogin", "on"])
+    volume = plistlib.readPlistFromString(subprocess.Popen([
+        "/usr/sbin/diskutil", "info", "-plist", "/",
+    ], stdout=subprocess.PIPE).communicate()[0])
+    disk = plistlib.readPlistFromString(subprocess.Popen([
+        "/usr/sbin/diskutil", "info", "-plist", volume["ParentWholeDisk"],
+    ], stdout=subprocess.PIPE).communicate()[0])
+    if disk["TotalSize"] - volume["TotalSize"] > 1024 ** 3:
+        size = "R"
+        if version == ["10", "6"]:
+            limits = subprocess.Popen([
+                "/usr/sbin/diskutil", "resizeVolume", "/", "limits",
+            ], stdout=subprocess.PIPE).communicate()[0]
+            maximum = re.search(r"Maximum size:.*\((\d+) Bytes\)", limits)
+            if not maximum:
+                raise ValueError("The guest filesystem's maximum size could not be read.")
+            size = maximum.group(1) + "B"
+        subprocess.check_call(["/usr/sbin/diskutil", "resizeVolume", "/", size])
+        subprocess.check_call([
+            "/usr/sbin/bless", "--folder", "/System/Library/CoreServices", "--bootefi",
+        ])
+    notice = home + "/VM Login.txt"
+    write(notice, ("VM Login\n\nUsername: " + username + "\nPassword: " + password + "\n").encode("ascii"))
+    os.chown(notice, 501, account.pw_gid)
+    agents = home + "/Library/LaunchAgents"
+    if not os.path.isdir(agents):
+        os.makedirs(agents)
+    agent = agents + "/net.paperclover.snowglobe.welcome.plist"
+    plistlib.writePlist({
+        "Label": "net.paperclover.snowglobe.welcome",
+        "ProgramArguments": ["/usr/bin/python", SCRIPT, "welcome"],
+        "RunAtLoad": True,
+        "KeepAlive": {"SuccessfulExit": False},
+        "ThrottleInterval": 10,
+    }, agent)
+    os.chmod(agent, 0o644)
+    os.chown(agents, 501, account.pw_gid)
+    os.chown(agent, 501, account.pw_gid)
+    autologin(username, password)
+    write(STATE + "/prepared", b"")
+    subprocess.check_call(["/sbin/shutdown", "-r", "now"])
+
+
+if __name__ == "__main__":
+    main()
diff --git a/guest/windows-provision.ps1 b/guest/windows-provision.ps1
new file mode 100644
index 0000000000000000000000000000000000000000..56c9bbad38019a257ff20a84a9d67233e1bded7c
--- /dev/null
+++ b/guest/windows-provision.ps1
@@ -0,0 +1,102 @@
+param([switch]$Prepare)
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+$root = 'C:\Snowglobe'
+$status = Join-Path $root 'setup'
+$winlogon = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
+
+function Set-SetupStatus([string]$stage) {
+    $path = Join-Path $status $stage
+    if (!(Test-Path $path)) {
+        [IO.File]::Open($path, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::ReadWrite).Dispose()
+    }
+}
+
+try {
+    if ($Prepare) {
+        Remove-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' -Name SnowglobeBootstrap -ErrorAction SilentlyContinue
+        Unregister-ScheduledTask -TaskName SnowglobeFinalize -Confirm:$false -ErrorAction SilentlyContinue
+        & "$root\install-guest.ps1" -Binary "$root\snowglobe-guest.exe" -User sandbox
+        (Get-LocalUser -Name sandbox).SID.Value | Set-Content "$root\template.sid" -Encoding ASCII
+        Get-ScheduledTask -TaskName 'SnowglobeGuest-*' | Disable-ScheduledTask | Out-Null
+        Get-Process snowglobe-guest -ErrorAction SilentlyContinue | Stop-Process -Force
+        $action = New-ScheduledTaskAction -Execute "$env:WINDIR\System32\WindowsPowerShell\v1.0\powershell.exe" -Argument '-NoProfile -ExecutionPolicy Bypass -File C:\Snowglobe\windows-provision.ps1'
+        $trigger = New-ScheduledTaskTrigger -AtStartup
+        $principal = New-ScheduledTaskPrincipal -UserId SYSTEM -LogonType ServiceAccount -RunLevel Highest
+        $settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -ExecutionTimeLimit (New-TimeSpan -Minutes 5)
+        Register-ScheduledTask -TaskName SnowglobeProvision -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null
+        $password = [Guid]::NewGuid().ToString('N') + [Guid]::NewGuid().ToString('N')
+        Set-LocalUser sandbox -Password (ConvertTo-SecureString $password -AsPlainText -Force) -PasswordNeverExpires $true
+        Set-ItemProperty $winlogon AutoAdminLogon '1'
+        Set-ItemProperty $winlogon DefaultUserName 'sandbox'
+        Set-ItemProperty $winlogon DefaultDomainName $env:COMPUTERNAME
+        Set-ItemProperty $winlogon DefaultPassword $password
+        Remove-ItemProperty $winlogon AutoLogonCount -ErrorAction SilentlyContinue
+        powercfg.exe /hibernate off
+        Remove-Item "$root\identity.ini", "$root\provisioned" -Force -ErrorAction SilentlyContinue
+        if (Test-Path $status) { Remove-Item $status -Recurse -Force }
+        return
+    }
+
+    New-Item $status -ItemType Directory -Force | Out-Null
+    if (Test-Path "$status\ready") { return }
+    if (Test-Path "$status\failed") { Remove-Item "$status\failed" -Force }
+    Set-SetupStatus personalizing
+    $seed = $null
+    $deadline = (Get-Date).AddMinutes(1)
+    while (!$seed) {
+        $seed = 68..90 | ForEach-Object { '{0}:\SNOWGLOB.INI' -f [char]$_ } | Where-Object { Test-Path $_ } | Select-Object -First 1
+        if ($seed) { break }
+        if ((Get-Date) -gt $deadline) { throw 'The VM login was not attached.' }
+        Start-Sleep -Milliseconds 250
+    }
+    $values = @{}
+    foreach ($line in Get-Content $seed) {
+        $pair = $line.Split('=', 2)
+        if ($pair.Count -eq 2) { $values[$pair[0]] = $pair[1] }
+    }
+    if (Test-Path "$status\restarting") {
+        if ($env:COMPUTERNAME -ine $values['HOSTNAME']) { throw 'The VM name was not applied.' }
+        $scheduler = New-Object -ComObject Schedule.Service
+        $scheduler.Connect()
+        $tasks = $scheduler.GetFolder('\').GetTasks(1) | Where-Object { $_.Name -like 'SnowglobeGuest-*' }
+        foreach ($task in $tasks) { $task.Enabled = $true }
+        $deadline = (Get-Date).AddMinutes(2)
+        while (!(Get-Process explorer -ErrorAction SilentlyContinue)) {
+            if ((Get-Date) -gt $deadline) { throw 'The desktop did not start.' }
+            Start-Sleep -Milliseconds 250
+        }
+        foreach ($task in $tasks) { $task.Run($null) | Out-Null }
+        while (!(Get-Process explorer -ErrorAction SilentlyContinue) -or !(Get-Process snowglobe-guest -ErrorAction SilentlyContinue)) {
+            if ((Get-Date) -gt $deadline) { throw 'The desktop did not start.' }
+            Start-Sleep -Milliseconds 250
+        }
+        Set-SetupStatus ready
+        return
+    }
+    $username = $values['USERNAME']
+    $password = $values['PASSWORD']
+    $hostname = $values['HOSTNAME']
+    if ($username -notmatch '^[A-Za-z0-9][A-Za-z0-9._-]{0,19}$') { throw 'The VM account name is unsupported.' }
+    if ($password.Length -lt 12 -or $password.Length -gt 128 -or $password -match '[\r\n]') { throw 'The VM password is malformed.' }
+    if ($hostname -notmatch '^sgvm-[a-f0-9]{8}$') { throw 'The VM name is malformed.' }
+    $sid = Get-Content "$root\template.sid"
+    $user = Get-LocalUser | Where-Object { $_.SID.Value -eq $sid }
+    if (!$user) { throw 'The template account is missing.' }
+    if (Get-LocalUser | Where-Object { $_.Name -ieq $username -and $_.SID.Value -ne $sid }) { throw 'The VM account name is already in use.' }
+    $user | Set-LocalUser -Password (ConvertTo-SecureString $password -AsPlainText -Force) -PasswordNeverExpires $true
+    if ($user.Name -ine $username) { $user | Rename-LocalUser -NewName $username }
+    Rename-Computer -NewName $hostname -Force
+    Set-ItemProperty $winlogon AutoAdminLogon '1'
+    Set-ItemProperty $winlogon DefaultUserName $username
+    Set-ItemProperty $winlogon DefaultDomainName $hostname
+    Set-ItemProperty $winlogon DefaultPassword $password
+    Remove-ItemProperty $winlogon AutoLogonCount -ErrorAction SilentlyContinue
+    Set-SetupStatus restarting
+    Restart-Computer -Force
+} catch {
+    if ($Prepare) { throw }
+    Set-SetupStatus failed
+    Add-Content "$root\setup.log" $_.Exception.Message
+    exit 1
+}
diff --git a/guest/windows.c b/guest/windows.c
index bc691b67a8e502da81c97c8093a16a13ab7f3bf5..0ce9d72204a8d67032c618edc1b5539f9e40f269 100644
--- a/guest/windows.c
+++ b/guest/windows.c
@@ -154,6 +154,7 @@ static void stream(DWORD session) {
     if (begin_period && end_period) begin_period(1);
     receiving.hEvent = CreateEventW(NULL, TRUE, FALSE, NULL);
     if (!screen || !dc || !receiving.hEvent) goto done;
+    SetThreadExecutionState(ES_CONTINUOUS | ES_DISPLAY_REQUIRED);
     if (frequency.QuadPart <= 0 || frequency.QuadPart > 0xffffffffu) goto done;
     uint32_t capabilities[SG_CAPABILITIES_WORDS] = {modern_windows, 1};
     if (!emit(SG_CAPABILITIES, capabilities, SG_CAPABILITIES_WORDS, NULL, 0)) goto done;
@@ -193,6 +194,7 @@ static void stream(DWORD session) {
                 if (request[7] == SG_STREAM) {
                     if (capturing != request[15]) {
                         capturing = request[15];
+                        SetThreadExecutionState(ES_CONTINUOUS | (capturing ? ES_DISPLAY_REQUIRED : 0));
                         initial = 1; last_cursor = NULL; last_flags = ~0u;
                         if (!capturing) { sg_capture_stop(); windows_active = 0; }
                     }
@@ -315,6 +317,7 @@ window_capture:
         Sleep(1);
     }
 done:
+    SetThreadExecutionState(ES_CONTINUOUS);
     sg_capture_stop();
     if (begin_period && end_period) end_period(1);
     if (winmm) FreeLibrary(winmm);
diff --git a/nixos/configuration.nix b/nixos/configuration.nix
index 52e635fb7c73c8f37e1971ba560eff7024da2f8a..055a74206338f198c4c8d929375e00b61b1a8827 100644
--- a/nixos/configuration.nix
+++ b/nixos/configuration.nix
@@ -6,7 +6,7 @@ let
   proxyToken = "/var/lib/studio/dashboard-proxy.token";
   hostTools = lib.fileset.toSource {
     root = ../.;
-    fileset = lib.fileset.unions [ ../tools/dashboard-host.py ../tools/shale-labels.py ../config/shale.json ../dashboard/src/host-protocol.json ../tools/vms.py ../tools/dashboard-run.py ../tools/release.py ../guest/protocol.json ];
+    fileset = lib.fileset.unions [ ../tools/dashboard-host.py ../tools/shale-labels.py ../config/shale.json ../dashboard/src/host-protocol.json ../tools/vms.py ../tools/vm-ssh.py ../tools/dashboard-run.py ../tools/release.py ../guest/protocol.json ];
   };
   nativePkl = pkgs.callPackage ./pkl.nix { };
   screenPython = pkgs.python3.withPackages (packages: [ packages.pygobject3 packages.gst-python ]);
@@ -16,7 +16,34 @@ let
     msVarsTemplate = true;
     tpmSupport = true;
   };
-
+  secureAavmf = pkgs.runCommand "aavmf-secure-2025.02" {
+    src = pkgs.fetchurl {
+      url = "https://deb.debian.org/debian/pool/main/e/edk2/qemu-efi-aarch64_2025.02-8+deb13u1_all.deb";
+      sha256 = "a00b2411a79c8aeafd95a7c868ac3cd1aab592f1af9fff965f02d81a625276ed";
+    };
+    nativeBuildInputs = [ pkgs.dpkg ];
+  } ''
+    dpkg-deb -x "$src" unpacked
+    mkdir -p "$out"
+    install -m444 unpacked/usr/share/AAVMF/AAVMF_CODE.secboot.fd "$out/code.fd"
+    install -m444 unpacked/usr/share/AAVMF/AAVMF_VARS.ms.fd "$out/vars.fd"
+  '';
+  windowsArmQemu = (pkgs.qemu.override {
+    minimal = true;
+    vncSupport = true;
+    tpmSupport = true;
+    enableBlobs = true;
+    hostCpuTargets = [ "aarch64-softmmu" ];
+  }).overrideAttrs (old: {
+    version = "11.1.2";
+    src = pkgs.fetchurl {
+      url = "https://download.qemu.org/qemu-11.1.2.tar.xz";
+      sha256 = "05l0hfx3kdkl719xqdps2nqcb5h2zn79nmri68qvw65vwj0mc6vk";
+    };
+    patches = [];
+    nativeBuildInputs = old.nativeBuildInputs ++ (with pkgs.python3Packages; [ qemu-qmp setuptools wheel pip ]);
+    buildInputs = old.buildInputs ++ [ pkgs.pixman pkgs.libtasn1 ];
+  });
 in
 {
   nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "nomad" "nvidia-x11" "nvidia-kernel-modules" ];
@@ -158,7 +185,7 @@ in
     wantedBy = [ "multi-user.target" ];
     wants = [ "podman.socket" ];
     after = [ "podman.socket" ];
-    path = [ pkgs.zfs pkgs.util-linux pkgs.python3 pkgs.libvirt pkgs.qemu pkgs.cdrkit pkgs.openssl pkgs.podman pkgs.nomad pkgs.systemd pkgs.rsync pkgs.nixos-rebuild nativePkl ]
+    path = [ pkgs.zfs pkgs.util-linux pkgs.python3 pkgs.libvirt pkgs.qemu pkgs.gptfdisk pkgs.cdrkit pkgs.openssl pkgs.openssh pkgs.podman pkgs.nomad pkgs.systemd pkgs.rsync pkgs.nixos-rebuild nativePkl ]
       ++ lib.optional (builtins.elem "nvidia" config.services.xserver.videoDrivers) (lib.getBin config.hardware.nvidia.package);
     environment = (lib.filterAttrs (name: _: lib.hasPrefix "STUDIO_" name) config.environment.variables) // {
       STUDIO_POOL = lib.attrByPath [ "STUDIO_POOL" ] "studio-demo" config.environment.variables;
@@ -309,5 +336,8 @@ in
   environment.variables.STUDIO_DOMAIN = lib.mkDefault "studio.test";
   environment.variables.STUDIO_VM_SECURE_OVMF_CODE = secureOvmf.firmware;
   environment.variables.STUDIO_VM_SECURE_OVMF_VARS = secureOvmf.variablesMs;
+  environment.variables.STUDIO_VM_SECURE_AAVMF_CODE = "${secureAavmf}/code.fd";
+  environment.variables.STUDIO_VM_SECURE_AAVMF_VARS = "${secureAavmf}/vars.fd";
+  environment.variables.STUDIO_VM_WINDOWS_ARM_EMULATOR = "${windowsArmQemu}/bin/qemu-system-aarch64";
   environment.systemPackages = with pkgs; [ acl curl jq openssl python3 rsync zfs qemu ] ++ [ nativePkl ];
 }
diff --git a/tools/benchmark-windows-init.py b/tools/benchmark-windows-init.py
new file mode 100644
index 0000000000000000000000000000000000000000..d3d0517e5075186c4c7920da974acb6712ef3510
--- /dev/null
+++ b/tools/benchmark-windows-init.py
@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+"""Measure a disposable Windows clone through completed desktop provisioning."""
+import argparse
+import json
+import time
+import vms
+
+parser = argparse.ArgumentParser(description=__doc__)
+parser.add_argument('preset')
+parser.add_argument('name')
+args = parser.parse_args()
+spec = {'name': args.name, 'description': 'Disposable Win10 provisioning benchmark', 'image': args.preset,
+        'vcpus': 4, 'memory': 4 * 2**30, 'disk': 64 * 2**30, 'autostart': False, 'start': True,
+        'mode': 'preset', 'firmware': 'uefi', 'platform': 'windows', 'owner': 'fixture-user', 'username': 'fixture'}
+vms.validate('create', spec)
+started = time.monotonic()
+print(json.dumps({'event': 'requested', 'timestamp': time.time(), 'name': args.name}), flush=True)
+vms.create(spec)
+print(json.dumps({'event': 'created', 'seconds': round(time.monotonic() - started, 2)}), flush=True)
+previous = None
+while time.monotonic() - started < 120:
+    stage = vms.windows_setup(args.name)
+    if stage != previous:
+        print(json.dumps({'event': stage, 'seconds': round(time.monotonic() - started, 2)}), flush=True)
+        previous = stage
+    if stage == 'failed':
+        raise RuntimeError('Guest provisioning failed; inspect C:\\Snowglobe\\setup.log.')
+    if stage == 'ready':
+        if time.monotonic() - started >= 60:
+            raise RuntimeError('Completed provisioning exceeded 60 seconds.')
+        break
+    time.sleep(.5)
+else:
+    raise TimeoutError('Guest provisioning did not finish.')
diff --git a/tools/dashboard-vms-test.py b/tools/dashboard-vms-test.py
index 72034ffded66122394fdbdb3e09ab3c15fe60b08..3163411e563e39f322865648f3d3f8ae8a3a9d16 100644
--- a/tools/dashboard-vms-test.py
+++ b/tools/dashboard-vms-test.py
@@ -22,6 +22,22 @@ spec.loader.exec_module(host)
 
 
 class VMTests(unittest.TestCase):
+    def test_windows_setup_closes_milestone_files(self):
+        for stage in ['ready', 'failed', 'restarting', 'personalizing']:
+            def reply(action, name, payload, *args):
+                command = json.loads(payload)
+                if command['execute'] == 'guest-file-close':
+                    self.assertEqual(command['arguments']['handle'], 7)
+                    return '{"return": {}}'
+                if command['arguments']['path'].endswith('\\' + stage):
+                    return '{"return": 7}'
+                raise vms.subprocess.CalledProcessError(1, 'virsh')
+            with self.subTest(stage=stage), patch.object(vms, 'virsh', side_effect=reply) as call:
+                self.assertEqual(vms.windows_setup('fixture'), stage)
+                self.assertEqual(json.loads(call.call_args.args[2])['execute'], 'guest-file-close')
+        with patch.object(vms, 'virsh', side_effect=vms.subprocess.CalledProcessError(1, 'virsh')):
+            self.assertEqual(vms.windows_setup('fixture'), 'starting')
+
     def test_guest_channel_uses_libvirts_truncated_domain_name(self):
         name = 'window-stream-win11-test'
         path = f'/run/libvirt/qemu/channel/175-{name[:20]}/{vms.GUEST_CHANNEL}'
@@ -88,6 +104,7 @@ class VMTests(unittest.TestCase):
             'Windows 8 RTM x64.iso': 'windows-q35-bios',
             'Windows 10 22H2 English x64.iso': 'windows-q35-uefi',
             'Windows 11 26H2 English x64.iso': 'windows-q35-secure',
+            'Windows 11 26H2 English arm64.iso': 'windows-aarch64-nvme',
             'Fedora-Workstation-Live-44-1.7.aarch64.iso': 'linux-aarch64-virtio',
         }
         for name, expected in cases.items():
@@ -99,8 +116,6 @@ class VMTests(unittest.TestCase):
         self.assertEqual(vms.profile('linux-aarch64-virtio')['serial'], 'ttyAMA0')
         self.assertEqual(vms.profile('windows-q35-secure')['cpu_mode'], 'host-passthrough')
         self.assertEqual(vms.profile('windows-q35-secure')['clock'], 'utc')
-        with self.assertRaisesRegex(ValueError, 'Windows ARM'):
-            vms.installer_profile(Path('Windows 11 26H2 English arm64.iso'), windows)
 
     def test_existing_presets_receive_a_safe_profile(self):
         with tempfile.TemporaryDirectory() as temporary:
diff --git a/tools/prepare-windows-preset.py b/tools/prepare-windows-preset.py
new file mode 100644
index 0000000000000000000000000000000000000000..8c621389975c16b7903bdf52542a4b8ab9c3269d
--- /dev/null
+++ b/tools/prepare-windows-preset.py
@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+"""Publish a clean, signed-in sandbox Windows template with the built guest agent."""
+import argparse
+import base64
+import json
+from pathlib import Path
+import time
+import vms
+
+parser = argparse.ArgumentParser(description=__doc__)
+parser.add_argument('name', help='Running disposable template with the sandbox administrator signed in')
+parser.add_argument('id', help='New immutable preset ID')
+parser.add_argument('--supersedes', required=True)
+args = parser.parse_args()
+for name in [args.name, args.id, args.supersedes]:
+    vms.ensure_name(name)
+if (vms.PRESETS / args.id).exists():
+    raise ValueError('A preset already has this name.')
+root = Path(__file__).resolve().parent.parent
+preset = vms.read_preset(args.supersedes)
+if preset['platform'] != 'windows' or preset['arch'] != 'x86_64':
+    raise ValueError('Select a Windows preset.')
+files = [(root / 'guest/install.ps1', 'install-guest.ps1'),
+         (root / 'guest/windows-provision.ps1', 'windows-provision.ps1'),
+         (root / 'guest/build/snowglobe-guest-x86_64.exe', 'snowglobe-guest.exe')]
+contents = [(path.read_bytes(), name) for path, name in files]
+
+def qga(operation, **arguments):
+    command = {'execute': operation}
+    if arguments:
+        command['arguments'] = arguments
+    return json.loads(vms.virsh('qemu-agent-command', args.name, json.dumps(command), '--timeout', '15'))['return']
+
+def wait(pid):
+    deadline = time.monotonic() + 180
+    while True:
+        result = qga('guest-exec-status', pid=pid)
+        if result.get('exited'):
+            if result.get('exitcode') != 0:
+                raise RuntimeError(base64.b64decode(result.get('err-data', '')).decode(errors='replace'))
+            return
+        if time.monotonic() > deadline:
+            raise TimeoutError('Template preparation did not finish; inspect the existing process before retrying.')
+        time.sleep(.25)
+
+pid = qga('guest-exec', path='powershell.exe', arg=['-NoProfile', '-NonInteractive', '-Command',
+    "New-Item C:\\Snowglobe -ItemType Directory -Force | Out-Null; Stop-ScheduledTask -TaskName SnowglobeProvision -ErrorAction SilentlyContinue"], **{'capture-output': True})['pid']
+wait(pid)
+for content, name in contents:
+    handle = qga('guest-file-open', path='C:\\Snowglobe\\' + name, mode='w')
+    try:
+        qga('guest-file-write', handle=handle, **{'buf-b64': base64.b64encode(content).decode()})
+    finally:
+        qga('guest-file-close', handle=handle)
+pid = qga('guest-exec', path='powershell.exe', arg=['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass',
+    '-File', 'C:\\Snowglobe\\windows-provision.ps1', '-Prepare'], **{'capture-output': True})['pid']
+wait(pid)
+vms.virsh('shutdown', args.name, '--mode', 'agent')
+deadline = time.monotonic() + 120
+while vms.virsh('domstate', args.name).strip() != 'shut off':
+    if time.monotonic() > deadline:
+        raise TimeoutError('The template did not shut down.')
+    time.sleep(.5)
+vms.save_preset({'name': args.name, 'id': args.id, 'os': preset['os'],
+                 'description': 'Prepared desktop with cursor integration', 'setup': 'windows-v3', 'supersedes': args.supersedes})
+(vms.PRESETS / args.id / 'disk.qcow2').chmod(0o440)
+print(args.id)
diff --git a/tools/vm-ssh.py b/tools/vm-ssh.py
new file mode 100644
index 0000000000000000000000000000000000000000..8e68b6836d20869d830c77f31da21784211d5ea5
--- /dev/null
+++ b/tools/vm-ssh.py
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+import json
+import os
+import re
+import subprocess
+import sys
+
+import vms
+
+
+def main():
+    if len(sys.argv) != 2:
+        raise ValueError("Usage: vm-ssh.py VM")
+    name = sys.argv[1]
+    vms.ensure_name(name)
+    if vms.virsh("domstate", name).strip() != "running":
+        raise ValueError("Start this VM before connecting through SSH.")
+    directory = vms.DISKS / name
+    with os.fdopen(vms.open_regular(directory / "access.json")) as incoming:
+        username = json.load(incoming)["username"]
+    if not re.fullmatch(r"[a-z_][a-z0-9_-]{0,31}", username):
+        raise ValueError("This VM has no supported SSH account.")
+    forwards = re.findall(
+        r"^\s*TCP\[HOST_FORWARD\]\s+\d+\s+(\S+)\s+(\d+)\s+\S+\s+22\s",
+        vms.virsh("qemu-monitor-command", name, "--hmp", "info usernet"),
+        re.MULTILINE,
+    )
+    if len(forwards) != 1 or forwards[0][0] != "127.0.0.1":
+        raise ValueError("This VM has no private SSH connection.")
+    port = int(forwards[0][1])
+    if not 1 <= port <= 65535:
+        raise ValueError("This VM has no private SSH connection.")
+    for file in ["ssh_key", "ssh_known_hosts"]:
+        os.close(vms.open_regular(directory / file))
+    args = [
+        "ssh", "-F", "/dev/null", "-i", str(directory / "ssh_key"), "-p", str(port),
+        "-o", "IdentitiesOnly=yes", "-o", "BatchMode=yes",
+        "-o", "PreferredAuthentications=publickey", "-o", "ForwardAgent=no",
+        "-o", "ClearAllForwardings=yes", "-o", "StrictHostKeyChecking=yes",
+        "-o", "HostKeyAlias=" + name,
+        "-o", "UserKnownHostsFile=" + str(directory / "ssh_known_hosts"),
+        "-o", "GlobalKnownHostsFile=/dev/null", "-o", "ConnectTimeout=10",
+        "-o", "HostKeyAlgorithms=+ssh-rsa", "-o", "PubkeyAcceptedAlgorithms=+ssh-rsa",
+        "-o", "KexAlgorithms=+diffie-hellman-group14-sha1",
+    ]
+    command = os.environ.get("SSH_ORIGINAL_COMMAND")
+    if not command:
+        args.append("-tt")
+    args.append(username + "@127.0.0.1")
+    if command:
+        args.append(command)
+    os.execvp(args[0], args)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (ValueError, OSError, KeyError) as error:
+        print(str(error), file=sys.stderr)
+        sys.exit(1)
+    except subprocess.CalledProcessError:
+        print("The VM's private SSH connection could not be read.", file=sys.stderr)
+        sys.exit(1)
diff --git a/tools/vms.py b/tools/vms.py
index eb427e1a3b2a0564b91ee22c8a4d1e54c7a5c1c8..2659fc3ba52568a29ecf9bab7c211660d699b0cb 100644
--- a/tools/vms.py
+++ b/tools/vms.py
@@ -33,16 +33,22 @@ PROFILES = {
         "network": "virtio", "usb": "qemu-xhci", "clock": "utc", "emulated": True,
         "scsi": True, "video": "virtio", "keyboard": "usb", "serial": "ttyAMA0",
     },
+    "windows-aarch64-nvme": {
+        "arch": "aarch64", "machine": "virt-11.1", "platform": "windows", "firmware": "uefi",
+        "disk": ("nvme0n1", "nvme"), "cd": ("sda", "usb"), "network": "virtio",
+        "usb": "qemu-xhci", "clock": "utc", "emulated": True, "secure": True,
+        "video": "virtio", "keyboard": "usb", "gic": "3", "tpm": "tpm-tis",
+    },
     "windows-q35-uefi": {
         "arch": "x86_64", "machine": "q35", "platform": "windows", "firmware": "uefi",
         "disk": ("sda", "sata"), "cd": ("sdb", "sata"), "network": "e1000e",
-        "usb": "qemu-xhci", "clock": "localtime", "tpm": True,
+        "usb": "qemu-xhci", "clock": "localtime", "tpm": "tpm-crb", "cpu_mode": "host-passthrough",
     },
     "windows-q35-secure": {
         "arch": "x86_64", "machine": "q35", "platform": "windows", "firmware": "uefi",
         "disk": ("sda", "sata"), "cd": ("sdb", "sata"), "network": "e1000e",
         "usb": "qemu-xhci", "clock": "utc", "cpu_mode": "host-passthrough",
-        "tpm": True, "secure": True, "smm": True,
+        "tpm": "tpm-crb", "secure": True, "smm": True,
     },
     "windows-q35-bios": {
         "arch": "x86_64", "machine": "pc-q35-10.2", "platform": "windows", "firmware": "bios",
@@ -54,6 +60,12 @@ PROFILES = {
         "disk": ("hda", "ide"), "cd": ("hdc", "ide"), "network": "e1000",
         "usb": "piix3-uhci", "clock": "localtime", "balloon": "none",
     },
+    "macos-legacy-q35": {
+        "arch": "x86_64", "machine": "pc-q35-10.2", "platform": "macos", "firmware": "uefi",
+        "disk": ("sda", "sata"), "cd": ("sdb", "sata"), "network": "e1000-82545em",
+        "usb": "ich9-ehci1", "clock": "utc", "cpu": "Penryn", "emulated": True,
+        "keyboard": "usb", "balloon": "none",
+    },
 }
 ACTION_FIELDS = {
     "node": None, "domains": None, "stats": None,
@@ -74,10 +86,10 @@ def profile(name):
 
 
 def default_profile(platform, firmware, arch="x86_64"):
+    if platform == "macos":
+        return "macos-legacy-q35"
     if arch == "aarch64":
-        if platform != "linux":
-            raise ValueError("Windows ARM needs a tested ARM hardware profile.")
-        return "linux-aarch64-virtio"
+        return "windows-aarch64-nvme" if platform == "windows" else "linux-aarch64-virtio"
     if platform == "windows":
         return "windows-q35-uefi" if firmware == "uefi" else "windows-q35-bios"
     return "linux-x86-virtio"
@@ -110,8 +122,6 @@ def inferred_profile(root):
     firmware = "uefi" if (os_element is not None and (os_element.find("loader") is not None or os_element.get("firmware") == "efi")) else "bios"
     if machine.startswith("pc-i440fx"):
         return "windows-legacy-ide"
-    if arch == "aarch64":
-        return "linux-aarch64-virtio"
     return default_profile(platform, firmware, arch)
 
 
@@ -171,8 +181,10 @@ def validate(action, payload):
             raise ValueError("Choose a signed-in account to create this VM.")
         if payload["mode"] not in {"iso", "preset"}:
             raise ValueError("Choose an installer or a prepared preset.")
-        if payload["firmware"] not in {"bios", "uefi"} or payload["platform"] not in {"linux", "windows"}:
+        if payload["firmware"] not in {"bios", "uefi"} or payload["platform"] not in {"linux", "windows", "macos"}:
             raise ValueError("Choose supported firmware and guest hardware.")
+        if payload["platform"] == "macos" and payload["mode"] != "preset":
+            raise ValueError("Use a prepared OS X preset.")
         image = payload["image"]
         validate_image_id(image)
         host = node()
@@ -274,6 +286,7 @@ def domains():
             ticks = int(Path(f"/proc/{pid}/stat").read_text().rsplit(") ", 1)[1].split()[19])
             started = boot + ticks / os.sysconf("SC_CLK_TCK")
         agent = root.find("./devices/channel/target[@name='org.qemu.guest_agent.0']")
+        setup = root.findtext(f"metadata/{NS}vm/{NS}setup")
         result.append({
             "name": name,
             "owner": root.findtext(f"metadata/{NS}vm/{NS}owner"),
@@ -288,6 +301,7 @@ def domains():
             "autostart": re.search(r"^Autostart:\s+enable", virsh("dominfo", name), re.MULTILINE) is not None,
             "startedAt": started,
             "agent": agent.get("state", "disconnected") if agent is not None else None,
+            "setup": windows_setup(name) if setup == "windows-v3" and state == "running" else None,
             "disks": disks,
             "media": media,
             "firmware": "uefi" if root.find("./os/loader") is not None or root.find("os").get("firmware") == "efi" else "bios",
@@ -300,6 +314,20 @@ def domains():
     return result
 
 
+def windows_setup(name):
+    for stage in ["ready", "failed", "restarting", "personalizing"]:
+        try:
+            handle = json.loads(virsh("qemu-agent-command", name, json.dumps({"execute": "guest-file-open", "arguments": {"path": "C:\\Snowglobe\\setup\\" + stage, "mode": "r"}}), "--timeout", "1"))["return"]
+        except (subprocess.CalledProcessError, ValueError, KeyError, TypeError):
+            continue
+        try:
+            virsh("qemu-agent-command", name, json.dumps({"execute": "guest-file-close", "arguments": {"handle": handle}}), "--timeout", "1")
+        except subprocess.CalledProcessError:
+            pass
+        return stage
+    return "starting"
+
+
 def ensure_name(name):
     if not isinstance(name, str) or not NAME.fullmatch(name):
         raise ValueError("invalid VM name")
@@ -366,8 +394,10 @@ def read_preset(identity):
             result = json.load(incoming)
         with os.fdopen(open_regular(directory / "disk.qcow2"), "rb") as incoming:
             details = json.loads(command("qemu-img", "info", "-U", "--output=json", f"/proc/self/fd/{incoming.fileno()}", pass_fds=(incoming.fileno(),)))
-        if not standalone(details) or result["firmware"] not in {"bios", "uefi"} or result["platform"] not in {"linux", "windows"}:
+        if not standalone(details) or result["firmware"] not in {"bios", "uefi"} or result["platform"] not in {"linux", "windows", "macos"}:
             raise ValueError("This preset needs to be prepared again.")
+        if "supersedes" in result:
+            ensure_name(result["supersedes"])
         result.setdefault("arch", "x86_64")
         result.setdefault("hardwareProfile", default_profile(result["platform"], result["firmware"], result["arch"]))
         checked_profile(result["hardwareProfile"], result["platform"], result["firmware"], result["arch"])
@@ -408,7 +438,8 @@ def library():
                 presets.append(read_preset(file.name))
             except (ValueError, subprocess.CalledProcessError):
                 continue
-    return {"installers": sorted(installers, key=lambda item: item["os"].lower()), "presets": presets, "arch": "x86_64"}
+    superseded = {item.get("supersedes") for item in presets}
+    return {"installers": sorted(installers, key=lambda item: item["os"].lower()), "presets": [item for item in presets if item["id"] not in superseded], "arch": "x86_64"}
 
 
 def managed_directory(path):
@@ -481,6 +512,10 @@ def save_preset(spec):
     if virsh("domstate", name).strip() != "shut off":
         raise ValueError("Shut down this VM before saving a preset.")
     root = ET.fromstring(virsh("dumpxml", name, "--inactive"))
+    if root.findtext(f"metadata/{NS}vm/{NS}platform") == "macos":
+        raise ValueError("Use a prepared OS X preset from the OS library.")
+    if root.findtext(f"metadata/{NS}vm/{NS}setup") in {"windows-v2", "windows-v3"} and spec.get("setup") != "windows-v3":
+        raise ValueError("Prepare a Windows template before publishing another preset.")
     disks = root.findall("./devices/disk[@device='disk']")
     if len(disks) != 1 or root.findall("./devices/hostdev"):
         raise ValueError("Use a VM with one disk and no passed-through devices.")
@@ -490,9 +525,6 @@ def save_preset(spec):
     file = Path(source.get("file"))
     if not file.is_relative_to(DISKS / name):
         raise ValueError("Use a disk stored with this VM.")
-    details = info(file)
-    if not standalone(details):
-        raise ValueError("Use a standalone disk without external data files.")
     base = PRESETS
     managed_directory(base)
     target = base / spec["id"]
@@ -503,8 +535,13 @@ def save_preset(spec):
         # Copy from a verified FD; never follow a swapped symlink to a host file.
         with os.fdopen(open_regular(file), "rb") as incoming:
             command("cp", "--reflink=auto", "--sparse=always", f"/proc/self/fd/{incoming.fileno()}", str(temporary / "source"), pass_fds=(incoming.fileno(),))
-        if not standalone(info(temporary / "source")):
-            raise ValueError("Use a standalone disk without external data files.")
+        details = info(temporary / "source")
+        if not standalone(details):
+            backing = Path(details.get("backing-filename", ""))
+            if (details.get("format") != "qcow2" or details.get("format-specific", {}).get("data", {}).get("data-file")
+                    or backing.parent.parent != PRESETS or backing.name != "disk.qcow2"):
+                raise ValueError("Use a standalone disk or an overlay of a prepared preset.")
+            read_preset(backing.parent.name)
         command("qemu-img", "convert", "-O", "qcow2", str(temporary / "source"), str(temporary / "disk.qcow2"))
         (temporary / "source").unlink()
         os_element = root.find("os")
@@ -524,6 +561,11 @@ def save_preset(spec):
                   "capacity": details["virtual-size"], "createdAt": int(time.time()),
                   "recommended": {"vcpus": int(root.findtext("vcpu", "2")),
                                   "memory": int(root.findtext("memory")) * 1024, "disk": details["virtual-size"]}}
+        if spec.get("setup") == "windows-v3" and platform == "windows":
+            preset["setup"] = "windows-v3"
+        if supersedes := spec.get("supersedes"):
+            ensure_name(supersedes)
+            preset["supersedes"] = supersedes
         (temporary / "preset.json").write_text(json.dumps(preset))
         # rename won't overwrite a nonempty preset, including a concurrent publication.
         temporary.rename(target)
@@ -546,9 +588,10 @@ def console_target(name):
     return {"port": port, "uuid": root.findtext("uuid")}
 
 
-def secure_firmware():
-    code = Path(os.environ.get("STUDIO_VM_SECURE_OVMF_CODE", ""))
-    variables = Path(os.environ.get("STUDIO_VM_SECURE_OVMF_VARS", ""))
+def secure_firmware(arch):
+    firmware = "AAVMF" if arch == "aarch64" else "OVMF"
+    code = Path(os.environ.get(f"STUDIO_VM_SECURE_{firmware}_CODE", ""))
+    variables = Path(os.environ.get(f"STUDIO_VM_SECURE_{firmware}_VARS", ""))
     if not code.is_absolute() or not variables.is_absolute():
         raise ValueError("Secure UEFI firmware is unavailable on this host.")
     try:
@@ -622,6 +665,23 @@ def windows_seed(directory, username):
         command("genisoimage", "-quiet", "-output", str(directory / "seed.iso"), "-volid", "SNOWGLOBE", "-joliet", "-rock", str(marker))
 
 
+def macos_seed(directory, username):
+    if not re.fullmatch(r"[a-z_][a-z0-9_-]{0,31}", username) or username == "root":
+        raise ValueError("Use an account username suitable for an OS X guest.")
+    hostname = "snowglobe-vm-" + secrets.token_hex(4)
+    password = guest_access(directory, username, hostname)
+    command("ssh-keygen", "-q", "-t", "rsa", "-b", "3072", "-m", "PEM", "-N", "", "-f", str(directory / "ssh_key"))
+    with tempfile.TemporaryDirectory(prefix=".seed-", dir=directory) as temporary:
+        files = Path(temporary)
+        (files / "access.json").write_text(json.dumps({"username": username, "password": password, "hostname": hostname}))
+        (files / "authorized_keys").write_text('from="10.0.2.2",no-agent-forwarding,no-port-forwarding,no-X11-forwarding ' + (directory / "ssh_key.pub").read_text())
+        command("ssh-keygen", "-q", "-t", "rsa", "-b", "3072", "-m", "PEM", "-N", "", "-f", str(files / "ssh_host_rsa_key"))
+        (directory / "ssh_known_hosts").write_text(directory.name + " " + (files / "ssh_host_rsa_key.pub").read_text())
+        command("genisoimage", "-quiet", "-output", str(directory / "seed.iso"), "-volid", "SNOWGLOBE", "-joliet", "-rock", str(files))
+    (directory / "ssh_key.pub").unlink()
+    (directory / "seed.iso").chmod(0o600)
+
+
 def create(spec):
     name = spec["name"]
     ensure_name(name)
@@ -641,6 +701,8 @@ def create(spec):
         profile_name = installer_profile(source, spec)
     details_profile = profile(profile_name)
     spec = {**spec, "firmware": details_profile["firmware"] or spec["firmware"], "platform": details_profile["platform"]}
+    if spec["platform"] == "macos" and spec["vcpus"] != 1:
+        raise ValueError("Use one vCPU for this OS X preset.")
     if not preset and source and architecture(source.name) != details_profile["arch"]:
         raise ValueError(f"Choose a {details_profile['arch']} ISO for this hardware profile.")
     if mode == "preset" and spec["disk"] < preset["capacity"]:
@@ -652,7 +714,7 @@ def create(spec):
         virsh("pool-start", "vms")
         virsh("pool-autostart", "vms")
     directory = DISKS / name
-    directory.mkdir(parents=True, exist_ok=False)
+    directory.mkdir(mode=0o700, parents=True, exist_ok=False)
     drive = directory / "disk.qcow2"
 
     def expired(_signum, _frame):
@@ -662,7 +724,15 @@ def create(spec):
     signal.alarm(840)
     try:
         os_name = "Other"
-        if source:
+        overlay = preset and not (spec["platform"] == "macos" and spec["disk"] > preset["capacity"])
+        if overlay:
+            os_name = preset["os"]
+            with os.fdopen(open_regular(source), "rb") as incoming:
+                details = json.loads(command("qemu-img", "info", "-U", "--output=json", f"/proc/self/fd/{incoming.fileno()}", pass_fds=(incoming.fileno(),)))
+                if not standalone(details):
+                    raise ValueError("This preset needs to be prepared again.")
+                command("qemu-img", "create", "-u", "-f", "qcow2", "-F", details["format"], "-b", str(source), str(drive), str(spec["disk"]))
+        elif source:
             source_fd = open_regular(source)
             frozen = directory / (source.name if source.suffix.lower() == ".iso" else "source-image")
             with os.fdopen(source_fd, "rb") as incoming:
@@ -678,12 +748,20 @@ def create(spec):
             if details.get("virtual-size", 0) > spec["disk"]:
                 raise ValueError("Choose a disk at least as large as the OS image.")
             source = frozen
-        if source and source.suffix.lower() != ".iso":
-            command("qemu-img", "convert", "-O", "qcow2", str(source), str(drive))
-            if spec["disk"] > info(drive)["virtual-size"]:
-                command("qemu-img", "resize", str(drive), str(spec["disk"]))
+        if not overlay and source and source.suffix.lower() != ".iso":
+            if spec["platform"] == "macos" and spec["disk"] > details["virtual-size"]:
+                expanded = directory / "expanded.raw"
+                command("qemu-img", "convert", "-O", "raw", str(source), str(expanded))
+                command("qemu-img", "resize", "-f", "raw", str(expanded), str(spec["disk"]))
+                command("sgdisk", "--move-second-header", str(expanded))
+                command("qemu-img", "convert", "-O", "qcow2", str(expanded), str(drive))
+                expanded.unlink()
+            else:
+                command("qemu-img", "convert", "-O", "qcow2", str(source), str(drive))
+                if spec["disk"] > info(drive)["virtual-size"]:
+                    command("qemu-img", "resize", str(drive), str(spec["disk"]))
             source.unlink()
-        else:
+        elif not overlay:
             command("qemu-img", "create", "-f", "qcow2", str(drive), str(spec["disk"]))
         virsh("pool-refresh", "vms")
         domain_type = "qemu" if details_profile.get("emulated") or os.environ.get("STUDIO_VM_ACCEL") == "qemu" else "kvm"
@@ -695,16 +773,22 @@ def create(spec):
         ET.SubElement(metadata, NS + "platform").text = spec["platform"]
         ET.SubElement(metadata, NS + "hardwareProfile").text = profile_name
         ET.SubElement(metadata, NS + "owner").text = spec["owner"]
+        if preset and preset.get("setup") == "windows-v3":
+            ET.SubElement(metadata, NS + "setup").text = "windows-v3"
         ET.SubElement(root, "memory", unit="bytes").text = str(spec["memory"])
         ET.SubElement(root, "vcpu").text = str(spec["vcpus"])
         firmware = spec["firmware"]
         os_element = ET.SubElement(root, "os")
         if firmware == "uefi":
             if details_profile.get("secure"):
-                code, variables = secure_firmware()
+                code, variables = secure_firmware(details_profile["arch"])
                 nvram = directory / "nvram.fd"
                 copy_regular(variables, nvram)
-                ET.SubElement(os_element, "loader", readonly="yes", type="pflash", secure="yes").text = str(code)
+                loader = ET.SubElement(os_element, "loader", readonly="yes", type="pflash")
+                # Libvirt restricts the secure attribute to q35; AAVMF's enrolled variables enable it on ARM.
+                if details_profile["arch"] == "x86_64":
+                    loader.set("secure", "yes")
+                loader.text = str(code)
                 ET.SubElement(os_element, "nvram", template=str(variables), templateFormat="raw", format="raw").text = str(nvram)
             else:
                 os_element.set("firmware", "efi")
@@ -718,11 +802,19 @@ def create(spec):
         ET.SubElement(os_element, "boot", dev="cdrom" if source and source.suffix.lower() == ".iso" else "hd")
         if source and source.suffix.lower() == ".iso":
             ET.SubElement(os_element, "boot", dev="hd")
-        ET.SubElement(os_element, "bootmenu", enable="yes", timeout="5000")
+        if not preset:
+            ET.SubElement(os_element, "bootmenu", enable="yes", timeout="5000")
         features = ET.SubElement(root, "features")
         ET.SubElement(features, "acpi")
         if details_profile["arch"] == "x86_64":
             ET.SubElement(features, "apic")
+        if profile_name == "windows-q35-uefi":
+            hyperv = ET.SubElement(features, "hyperv", mode="custom")
+            for feature in ["relaxed", "vapic", "vpindex", "synic", "stimer", "frequencies", "tlbflush", "ipi"]:
+                ET.SubElement(hyperv, feature, state="on")
+            ET.SubElement(hyperv, "spinlocks", state="on", retries="8191")
+        if gic := details_profile.get("gic"):
+            ET.SubElement(features, "gic", version=gic)
         if details_profile.get("smm"):
             ET.SubElement(features, "smm", state="on")
         if cpu_mode := details_profile.get("cpu_mode"):
@@ -730,20 +822,32 @@ def create(spec):
         elif details_profile.get("cpu"):
             cpu = ET.SubElement(root, "cpu", mode="custom", match="exact", check="full")
             ET.SubElement(cpu, "model", fallback="forbid").text = details_profile["cpu"]
+            ET.SubElement(cpu, "feature", policy="require", name="hypervisor")
         elif root.get("type") == "qemu":
             ET.SubElement(root, "cpu", mode="maximum")
-        ET.SubElement(root, "clock", offset=details_profile["clock"])
+        if profile_name == "windows-q35-uefi":
+            ET.SubElement(root.find("cpu"), "topology", sockets="1", cores=str(spec["vcpus"]), threads="1")
+        clock = ET.SubElement(root, "clock", offset=details_profile["clock"])
+        if profile_name == "windows-q35-uefi":
+            ET.SubElement(clock, "timer", name="hypervclock", present="yes")
         ET.SubElement(root, "on_poweroff").text = "destroy"
         ET.SubElement(root, "on_reboot").text = "restart"
         ET.SubElement(root, "on_crash").text = "destroy"
         devices = ET.SubElement(root, "devices")
-        ET.SubElement(devices, "emulator").text = f"/run/current-system/sw/bin/qemu-system-{details_profile['arch']}"
+        emulator = f"/run/current-system/sw/bin/qemu-system-{details_profile['arch']}"
+        if profile_name == "windows-aarch64-nvme":
+            emulator = os.environ.get("STUDIO_VM_WINDOWS_ARM_EMULATOR", "")
+            if not Path(emulator).is_absolute():
+                raise ValueError("Windows ARM is unavailable on this host. Choose another OS.")
+        ET.SubElement(devices, "emulator").text = emulator
         if details_profile.get("scsi"):
             ET.SubElement(devices, "controller", type="scsi", index="0", model="virtio-scsi")
         primary = ET.SubElement(devices, "disk", type="file", device="disk")
         ET.SubElement(primary, "driver", name="qemu", type="qcow2")
         ET.SubElement(primary, "source", file=str(drive))
         ET.SubElement(primary, "target", dev=details_profile["disk"][0], bus=details_profile["disk"][1])
+        if details_profile["disk"][1] == "nvme":
+            ET.SubElement(primary, "serial").text = "snowglobe"
         cd = ET.SubElement(devices, "disk", type="file", device="cdrom")
         ET.SubElement(cd, "driver", name="qemu", type="raw")
         if source and source.suffix.lower() == ".iso":
@@ -762,9 +866,22 @@ def create(spec):
             windows_seed(directory, spec["username"])
             ET.SubElement(cd, "source", file=str(directory / "seed.iso"))
             ET.SubElement(cd, "serial").text = "snowglobe-provision"
-        nic = ET.SubElement(devices, "interface", type="network")
-        ET.SubElement(nic, "source", network="default")
-        ET.SubElement(nic, "model", type=details_profile["network"])
+        if spec["platform"] == "macos":
+            macos_seed(directory, spec["username"])
+            ET.SubElement(cd, "source", file=str(directory / "seed.iso"))
+            qemu_ns = "http://libvirt.org/schemas/domain/qemu/1.0"
+            ET.register_namespace("qemu", qemu_ns)
+            arguments = ET.SubElement(root, "{" + qemu_ns + "}commandline")
+            for argument in [
+                "-device", "isa-applesmc,osk=ourhardworkbythesewordsguardedpleasedontsteal(c)AppleComputerInc",
+                "-smbios", "type=2", "-netdev", "user,id=osxnet,restrict=yes,hostfwd=tcp:127.0.0.1:0-:22",
+                "-device", details_profile["network"] + ",netdev=osxnet,bus=pcie.0,addr=0x12",
+            ]:
+                ET.SubElement(arguments, "{" + qemu_ns + "}arg", value=argument)
+        else:
+            nic = ET.SubElement(devices, "interface", type="network")
+            ET.SubElement(nic, "source", network="default")
+            ET.SubElement(nic, "model", type=details_profile["network"])
         ET.SubElement(devices, "graphics", type="vnc", port="-1", autoport="yes", listen="127.0.0.1")
         video = {"type": details_profile.get("video", "vga"), "heads": "1", "primary": "yes"}
         if video["type"] == "vga":
@@ -773,15 +890,22 @@ def create(spec):
         ET.SubElement(devices, "input", type="tablet", bus="usb")
         if keyboard := details_profile.get("keyboard"):
             ET.SubElement(devices, "input", type="keyboard", bus=keyboard)
-        ET.SubElement(devices, "controller", type="usb", model=details_profile["usb"])
+        usb = ET.SubElement(devices, "controller", type="usb", index="0", model=details_profile["usb"])
+        if spec["platform"] == "macos":
+            ET.SubElement(usb, "address", type="pci", domain="0x0000", bus="0x00", slot="0x1d", function="0x7")
+            for index in range(3):
+                controller = ET.SubElement(devices, "controller", type="usb", index="0", model=f"ich9-uhci{index + 1}")
+                ET.SubElement(controller, "master", startport=str(index * 2))
+                ET.SubElement(controller, "address", type="pci", domain="0x0000", bus="0x00", slot="0x1d", function=hex(index), **({"multifunction": "on"} if index == 0 else {}))
         if details_profile.get("tpm"):
-            tpm = ET.SubElement(devices, "tpm", model="tpm-crb")
+            tpm = ET.SubElement(devices, "tpm", model=details_profile["tpm"])
             ET.SubElement(tpm, "backend", type="emulator", version="2.0")
         if details_profile.get("balloon"):
             ET.SubElement(devices, "memballoon", model=details_profile["balloon"])
-        ET.SubElement(devices, "console", type="pty")
-        ET.SubElement(devices, "channel", type="unix").append(ET.Element("target", type="virtio", name="org.qemu.guest_agent.0"))
-        ET.SubElement(devices, "channel", type="unix").append(ET.Element("target", type="virtio", name=GUEST_CHANNEL))
+        if spec["platform"] != "macos":
+            ET.SubElement(devices, "console", type="pty")
+            ET.SubElement(devices, "channel", type="unix").append(ET.Element("target", type="virtio", name="org.qemu.guest_agent.0"))
+            ET.SubElement(devices, "channel", type="unix").append(ET.Element("target", type="virtio", name=GUEST_CHANNEL))
         xml = directory / "domain.xml"
         xml.write_bytes(ET.tostring(root))
         signal.alarm(0)
@@ -789,7 +913,8 @@ def create(spec):
         if spec["autostart"]:
             virsh("autostart", name)
         if spec["start"]:
-            ensure_network()
+            if spec["platform"] != "macos":
+                ensure_network()
             virsh("start", name)
     except Exception:
         signal.alarm(0)
@@ -863,7 +988,9 @@ def main():
         name = payload["name"]
         ensure_name(name)
         if payload["action"] == "start":
-            ensure_network()
+            root = ET.fromstring(virsh("dumpxml", name, "--inactive"))
+            if root.find("./devices/interface/source[@network='default']") is not None:
+                ensure_network()
         virsh({"start": "start", "shutdown": "shutdown", "reboot": "reboot", "destroy": "destroy", "resume": "resume"}[payload["action"]], name)
     elif action == "update":
         name = payload["name"]